Pods need different AWS permissions, but all currently inherit an overly broad node role. Which workload-identity approach should be evaluated?

1. Give every pod the same permanent root access key.
2. Attach administrator privileges to the node so every pod can complete any operation.
3. Use an appropriate supported pod or service-account identity mechanism with scoped workload roles.
4. Use only pod display labels as an automatic IAM authorization grant.